HTTP header for indicating originating server behind load balancer

I'm writting this out of my head/memory as I don't have anything at hand to verify whether it works correctly or not, but I hope this might be some hint for you.

So, my answer is:

Of course you can do this with Apache's mod_proxy_balancer. You should be able to acomplish this with something like that:

ProxyPassReverse / http://host1:80/
ProxyPassReverse / http://host2:80/

<Proxy balancer://cluster>
  BalancerMember http://host1:80 route=LB1
  BalancerMember http://host2:80 route=LB2
  ProxySet stickysession=MYSESSIONID
</Proxy>

So, regarding point 1, read mod_proxy_balancer's "Request Counting Algorithm" section.

Regarding point 2: I really don't know about HTTP header parsing. Above example uses additional URL parameter MYSESSIONID to proxy traffic being part of the same connection to the same host. I guess you can also use cookies. Eitherway this should be handled by application identied as LB1 or LB2 (these are added as part of session id or cookie).

Re 3: load balancer monitors all it's members and disables them when they're unresponsive. You can also enable/disable nodes through web interface (mod_status, see "Enabling Balancer Manager Support").

As for the point 4, you can setup SSL enabled VirtualHost listening on port 443 that proxies all the trafic to balancer members port 80.

First of all, you should know that you are running an obsolete version of ModSecurity (branch 1.x). If you are running Apache 2.0.x you should upgrade to ModSecurity 2.x. If you are still running Apache 1.3.x then I am afraid that you don't have a choice since ModSecurity 2.x won't work with it. ModSecurity 1.x itself is not known to be vulnerable, but its rule engine is too inflexible for today's demands.

If I recall correctly, ModSecurity 1.x required POST requests to specify content length purely because it didn't support chunked request bodies (the alternative way of submitting request bodies, in which the total length is not known until the end). Chunked request bodies were incredibly rare then (we're talking years 2003, 2004) and are still rare (although some mobile devices are using them).

There are no such restrictions in ModSecurity 2.x.

If you remove that rule you will create a big hole through which someone could sneak in an attack undetected. On the other hand, I can argue that, with you running ModSecurity 1.x, there are other ways to do the same. Alternatively, tweak the rule to refuse requests that have the Transfer-Encoding request header set. You should be safe with that.

Disclosure: I wrote ModSecurity.